Mental health and prayer apps have some of the worst privacy protections, study claims